Website › Spam protection connects the project's own Google reCAPTCHA v3 key, so its forms can require proof that a person is sending them. It is off by default, and a form is protected only once you switch it on for that form.
reCAPTCHA v3 is invisible: visitors never solve a puzzle, Google scores each submission (0.0 likely a bot, 1.0 likely a person) and the platform checks the score before it stores the record. Existing form templates need no change — the platform adds the script to the pages and attaches the proof to every form submission on its own.
1. Create the key in Google#
- Open the Google Cloud console → Fraud Defense → reCAPTCHA → Keys and create a key of the Score-based (v3) type (the default) for a website.
- Add every domain listed on the Spam protection page: your custom domains and the project's platform hosts (
{project}.inbs.dev,demo-{project}.inbs.dev). A domain also covers its subdomains, soexample.comcoverswww.example.com. Changes take up to 30 minutes to apply. - Leave Disable domain verification off — Google then refuses proofs solved on any other site.
- Open the key's Integration tab → Use Legacy Key and copy the secret.
The key belongs to your Google Cloud project, and so does its usage: Google's free tier is 10,000 verifications a month, counted across every key in the same Google Cloud organization.
2. Connect it#
On Website › Spam protection:
- Paste the site key and the secret and save. The secret is stored encrypted and never shown again — the page says only that it is set; Remove deletes it.
- Turn on Enabled. From now on the pages load the reCAPTCHA script — only after a visitor starts filling in a form, so visitors who never touch a form never contact Google.
- Hide Google badge (optional) hides the floating badge. Nothing is shown in its place: Google asks a site that hides the badge to state that it uses reCAPTCHA, and where and how is up to you — in the privacy policy (reCAPTCHA, Google as your processor, the
_GRECAPTCHAcookie), or as a line in your form template.
Only the project owner can change the key; editors see the page read-only.
3. Protect a form#
Open the form's page (Forms → the form) and pick reCAPTCHA in its settings menu (the gear) — or, in the page editor, the form card's Access & protection panel. Switch on Require reCAPTCHA:
- Score floor — 0.3, 0.5 (default) or 0.7. A higher floor refuses more bots and occasionally a person.
- Below the floor — refuse (default; the visitor sees "We couldn't verify the submission. Please try again.") or keep and flag (the record is stored and marked suspect; useful where a lost enquiry costs more than a spam row).
The switch stays disabled until the key and its secret are connected. If the site is served by your own server (an external project on the SDK), update its vendor packages first — an old server does not pass the proof on and every submission would be refused.
Verdicts on records#
Every record of a protected form carries the verdict as a chip, also available as the reCAPTCHA listing column:
| Chip | Meaning |
|---|---|
score (e.g. 0.9) |
verified |
| suspect | below the floor, kept because the form flags instead of refusing |
| unverified | stored without a check — Google was unreachable, the free quota is used up, or the secret is missing or wrong |
| skipped | sent from the console's preview, where reCAPTCHA cannot run |
The platform fails open on problems on Google's side or in the key's setup: the submission is stored and marked unverified, never lost. A wrong, reused or foreign proof, or a low score on a refusing form, is refused.
Health#
The page shows the last problem the check ran into:
- No secret stored / The secret is invalid — submissions are accepted unverified; fix the secret.
- Over Google's free quota — submissions are accepted unverified until the month rolls over or billing is enabled on the Google Cloud project.
- Google unreachable — a transient network problem.
- Not a Score-based (v3) key — create a v3 key; v2 checkbox keys do not work.
- A domain is missing from the key — a visitor submitted from a domain the key does not list; add it in Google.
While Enabled is off but some forms are still protected, the page lists them: those forms refuse every submission, because the pages no longer send the proof.
Cookies and privacy#
reCAPTCHA sets the _GRECAPTCHA cookie and is catalogued as necessary in the cookie bar — it runs without asking, after Rescan lists it under Detected services. Courts and regulators are not unanimous on that classification; you can re-assign the service to another category, and the visitor then has to allow it before a protected form can be sent. Mention reCAPTCHA (Google as your processor, the purpose — protecting the forms from abuse) in the site's privacy policy.